In short: The cost of a cyberattack for a company consists of three groups: direct costs for incident handling, cleanup and consulting; indirect costs from downtime, working time and loss of trust; and follow-on costs for hardening, migration and rework. Flat sums are not credible. What holds up is your own calculation, which fills in each item with your figures and so makes prevention justifiable.
The calculation nobody draws up
In many budget rounds, security appears as a cost centre on one side. On the other side there is nothing, because the damage has not yet occurred. Only once a server has been taken over does it become visible how much adds up, and it is usually more than the service provider's invoice.
This week, PHP2Shell forced many companies into a trade-off: take the website offline immediately, as the BSI (German Federal Office for Information Security) recommended for systems that cannot be patched, or keep it running? That decision is also a question of cost. Anyone who knows what a day of downtime costs and what a break-in could cost decides more calmly. According to media reports, the city of Mainz, for example, took its central web portal offline as a precaution; the offices remained reachable by phone and email. Such an outage also has a price, but a plannable one.
The costs of a cyberattack at a glance
The following overview lists the typical items. Not every one arises in every incident, but each should be checked.
| Group | Cost item | What it depends on |
|---|---|---|
| Direct | incident handling and technical emergency help | duration, number of systems, time of day |
| Direct | IT forensics and evidence preservation | scope, need for court-proof documentation |
| Direct | cleanup or rebuild of servers | state of backups, documentation |
| Direct | legal and data protection advice | notification duties, contracts, claims |
| Direct | notifying data subjects, customer service | number of data subjects, channels |
| Indirect | lost revenue during the shutdown | dependence on the system, duration |
| Indirect | internal working time of management, IT, sales | preparation, clarity of roles |
| Indirect | loss of visibility in search engines | warning notices, injected spam |
| Indirect | blocked email delivery | misuse of the server for spam |
| Indirect | loss of trust among customers and partners | communication, type of data |
| Follow-on | hardening, monitoring, new processes | starting condition |
| Follow-on | migration of outdated software | e.g. PHP 8.1 and older |
| Follow-on | contract adjustments with service providers | existing arrangements |
| Follow-on | possible third-party claims or fines | individual case, legal assessment |
Direct costs: what appears on invoices
The direct costs are the easiest to capture because they arrive as invoices. They include technical help, forensics, cleanup and consulting. Their scope depends heavily on preparation. If there is a current inventory, tested backups and preserved logs, the analysis goes faster. If not, part of the work becomes a search for the basics. What a thorough investigation involves is described in IT forensics after a web server attack.
There are also items that do not come to mind at first: overtime of external service providers at the weekend, a replacement server for the interim period, or printing and postage of letters when data subjects have to be informed that way.
Indirect costs: what does not appear on invoices
The indirect costs are often larger and harder to grasp. A shop's lost revenue can be derived from your own figures. The working time of management, IT, sales and customer service, by contrast, is rarely recorded, even though an incident ties up many people for days.
Two consequences hit websites in particular. If Google finds malicious code, a warning notice can deter visitors until the cleanup is confirmed; how to have it removed is covered under Removing the Google warning. If the server is misused for spam, the company's emails end up on blocklists and no longer reach customers. Both often continue to have an effect for weeks after the technical cleanup.
Follow-on costs: what comes after the cleanup
Once the server is clean again, the bill is not yet closed. Almost every incident exposes omissions that now have to be made up: hardening of the servers, monitoring that warns earlier in future, tested backups, new credentials for everyone involved. If a system runs on PHP 8.1 or older, for which there are no official updates any more, a migration is often due that would have been needed anyway, but now under time pressure.
Organisational follow-on costs come on top. Contracts with the host and agency are revised, the emergency plan is adjusted, staff are trained. Some of these items are sensible investments that would have been cheaper without the incident. That is exactly the argument for prevention.
Drawing up your own calculation
Rather than outside statistics, a calculation with your own figures helps. Here is how to proceed:
- Name critical systems: Which websites, shops and portals carry revenue or processes?
- Estimate downtime cost per day: from sales data, order intake or working time that cannot be performed without the system.
- Count internal hours: Who would be tied up and for how long? Value this at internal hourly rates.
- Obtain direct items: Request framework quotes from service providers for emergency help and forensics.
- Compare insurance cover: Which items does the policy cover, and which excesses and conditions apply?
- Compare with prevention: What do inventory, patch process, backups, monitoring and maintenance cost per year?
Calculate with a range rather than a single figure: an incident discovered the same day and one that is only noticed after weeks. The difference shows what early detection is worth.
Whether cyber insurance covers individual items is governed solely by your insurance terms; notes on typical obligations are given in Cyber insurance: what counts in a claim. Possible third-party claims, contractual penalties or fines cannot be quantified in advance; that is a legal question for a lawyer and the data protection officer. This page is not legal advice.
How does PHP SOS help?
- Together with you, we identify the critical systems and show which cost items would realistically arise there in an incident.
- We check how well backups, logs and inventory are prepared, because the direct costs depend heavily on them.
- We prepare a written quote for prevention that you can set against your own calculation.
- We take on ongoing prevention through a security maintenance contract with a clearly described scope.
Conclusion: The most expensive items of a hack rarely appear on an invoice. Anyone who makes them visible beforehand with their own figures can justify prevention and decide faster in an emergency.
Frequently asked questions
What does a cyberattack cost a company?
That cannot be answered with a flat figure. The costs depend on the type and duration of the incident, the data affected, dependence on the system and preparation. Only a breakdown of cost items that you fill with your own figures is credible.
Which costs does cyber insurance cover?
That is governed by the insurance terms of your contract. It often concerns the costs of handling the incident, business interruption and certain liability cases, each with conditions and obligations. Clarify the scope in advance with your insurer or broker.
Which costs are overlooked most often?
Internal working time, the weeks after the incident, effects on email delivery and search engines, and the costs of measures that were actually due beforehand, such as migrating an outdated PHP version.
Can fines or damages be quantified in advance?
No. Whether such claims arise and in what amount depends on the individual case and is a legal question. The data protection officer and a lawyer are responsible for an assessment; this page is not legal advice.